﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="Using DBH"/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>Using DBH</title>

<meta name="MS-HAID" content="SymChk_f9e919d7-c05c-4f74-9972-bb1e1870da84.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(1545);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/using_dbh.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="dbh.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="additional_dbh_examples.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="symbols.htm">Symbols for Windows Debugging (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="dbh.htm">DBH</A> &gt; </div>
	<div id="winchm_template_title">Using DBH</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>DBH is a command-line tool that exposes many of the functions in the DbgHelp API (dbghelp.dll). It can display information about the contents of a symbol file, display specific details of the symbols in the file, and search through the file for symbols matching various criteria.</p>
<p>The functionality provided by DBH is similar to that provided within WinDbg, KD, and CDB by commands such as <a href="#Bookmark2050"><b>x (Examine Symbols)</b></a>. </p>
<h3><a id="running_dbh_in_interactive_mode"></a><a id="RUNNING_DBH_IN_INTERACTIVE_MODE"></a>Running DBH in Interactive Mode</h3>
<p>You start DBH with a simple command line, on which you specify the target module whose symbols you wish to investigate.  A target module can be an EXE program or a PDB symbol file. You can also specify a process ID (PID) to investigate.  See <a href="#Bookmark1547"><b>DBH Command-Line Options</b></a> for the full syntax.</p>
<p>When DBH starts, it loads the symbols for the specified module, and then presents you with a prompt at which you can type a variety of commands.  See <a href="#Bookmark1548">DBH Commands</a> for a list of available commands.</p>
<p>For example, the following sequence starts DBH by specifying the target process with process ID 4672, then executes the <b>enum</b> command at the DBH prompt to display symbols matching a specific pattern, and then executes the <b>q</b> command to quit DBH:</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre>C:\&gt; dbh -p:4672 
            400000 : TimeTest
          77820000 : ntdll
          77740000 : kernel32

pid:4672 mod:TimeTest[400000]: enum TimeTest!ma* 

 index            address     name
     1             42cc56 :   main
     3             415810 :   malloc
     5             415450 :   mainCRTStartup

pid:4672 mod:TimeTest[400000]: q 

goodbye </pre>
</td>
</tr>
</table></span></div>
<h3><a id="running_dbh_in_batch_mode"></a><a id="RUNNING_DBH_IN_BATCH_MODE"></a>Running DBH in Batch Mode</h3>
<p>If you wish to run only a single DBH command, you can specify it at the end of the command line.  This causes DBH to start, load the specified module, run the specified command, and then exit.</p>
<p>For example, the previous example could be replaced with a single command line:</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre>C:\&gt; dbh -p:4672 enum TimeTest!ma* 
           400000 : TimeTest
         77820000 : ntdll
         77740000 : kernel32

index            address     name
    1             42cc56 :   main
    3             415810 :   malloc
    5             415450 :   mainCRTStartup </pre>
</td>
</tr>
</table></span></div>
<p>This method of running DBH is called <i>batch mode</i>, because it can be easily used in batch files.  This version of the command line can also be followed by a pipe ( <b>|</b> ) which redirects the DBH output to another program.</p>
<h3><a id="specifying_the_target"></a><a id="SPECIFYING_THE_TARGET"></a>Specifying the Target</h3>
<p>DBH can select a target in three ways:  by the process ID of a running process, by the name of the executable, or by the name of the symbol file.  For example, if there is exactly one instance of MyProg.exe currently running, with process ID 1234, then the following commands are almost equivalent:</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre>C:\&gt; dbh -v -p:1234 
C:\&gt; dbh -v c:\mydir\myprog.exe 
C:\&gt; dbh -v c:\mydir\myprog.pdb </pre>
</td>
</tr>
</table></span></div>
<p>One difference between these commands is that when you start DBH by specifying the process ID, DBH uses the actual virtual addresses being used by this process.  When you start DBH by specifying the executable name or the symbol file name, DBH assumes that the module's base address is a standard value (for example, 0x01000000). You can then use the <b>base</b> command to specify the actual base address, thus shifting the addresses of all the symbols in the module.</p>
<p>DBH does not attach to the target process in the way that a debugger does.  DBH cannot cause a process to begin or end, nor can it alter how that process runs.  For DBH to attach to a process by its process ID, the target process has to be running, but once DBH has been started the target process can be terminated and DBH will continue to access its symbols.</p>
<h3><a id="decorated_and_undecorated_symbols"></a><a id="DECORATED_AND_UNDECORATED_SYMBOLS"></a>Decorated and Undecorated Symbols</h3>
<p>By default, DBH uses undecorated symbol names when displaying and searching for symbols.  If you turn off the <a href="#Bookmark1532">SYMOPT_UNDNAME</a> symbol option, or include the -d option on the DBH command line, decorations will be included.</p>
<p>For information on symbol decorations, see <a href="#Bookmark1498">Public and Private Symbols</a>.</p>
<h3><a id="exiting_dbh"></a><a id="EXITING_DBH"></a>Exiting DBH</h3>
<p>To exit DBH, use the <b>q</b> command at the DBH prompt.</p></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
